WO2020238414A1

WO2020238414A1 - Method and device for protection from deserialization vulnerability

Info

Publication number: WO2020238414A1
Application number: PCT/CN2020/083363
Authority: WO
Inventors: 郑祎
Original assignee: 深圳前海微众银行股份有限公司
Priority date: 2019-05-24
Filing date: 2020-04-03
Publication date: 2020-12-03
Also published as: CN110166459B; CN110166459A

Abstract

The present invention relates to the field of fintech, and disclosed are a method and device for protection from a deserialization vulnerability. The method comprises: a WebLogic server receives a data request sent by at least one client, and determines whether the data request comprises T3/T3S protocol data; if the WebLogic server determines that the data request comprises T3/T3S protocol data, determine whether the IP address of the client is a trusted IP address according to an internet protocol IP address of the client and a pre-configured IP address white list; and if the WebLogic server determines that the internet protocol IP address of the client is a trusted IP address, process the T3/T3S protocol data. By setting the white list in the WebLogic server, attacks of deserialization vulnerabilities are prevented as much as possible, and the security of the WebLogic server is improved.

Description

Method and device for protecting deserialization loopholes

Cross references to related applications

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on May 24, 2019, the application number is 201910438428.7, and the application name is "A method and device for protecting deserialization loopholes", the entire content of which is incorporated by reference In this application.

Technical field

The present invention relates to the technical field of financial technology (Fintech), in particular to a method and device for protecting deserialization loopholes.

Background technique

WebLogic is a middleware based on the Java EE architecture, which can be used as a Java application server for the development, integration, deployment and management of large-scale distributed Web applications, network applications and database applications. It is widely used in government, finance, medical, transportation, education, scientific research and other industries and fields.

WebLogic has a Java deserialization vulnerability. When an attacker sends carefully constructed deserialized data to WebLogic, the vulnerability will be triggered and the attacker's specified operation will be executed, which can control the server and steal data from the database, causing serious impact.

In the prior art, it is generally forbidden to deserialize classes with deserialization vulnerabilities. However, in the prior art, when a new class that causes deserialization vulnerabilities appears, the vulnerabilities can still be exploited and protection cannot be performed. And when replacing or deleting a class, because the replaced class is a Java basic class, the scope of influence is too large; when deleting a class, the functions that depend on the class cannot be used, which may affect the normal functions of WebLogic.

Summary of the invention

In view of this, the embodiments of the present invention provide a deserialization vulnerability protection method and device, which at least solve the problems existing in the prior art.

On the one hand, an embodiment of the present invention provides a method for protecting deserialization vulnerabilities, which is applied to a WebLogic server, including:

The WebLogic server receives a data request sent by at least one client, and determines whether the data request includes T3/T3S protocol data;

If the WebLogic server determines that the data request includes T3/T3S protocol data, determine whether the client's IP address is a trusted IP address according to the Internet Protocol IP address of the client and a pre-configured IP address whitelist;

If the WebLogic server determines that the Internet Protocol IP address of the client is a trusted IP address, it processes the T3/T3S protocol data so that the request is processed by the normal process.

Optionally, the WebLogic server determines whether the client's IP address is a trusted IP address according to the client's Internet Protocol IP address and a pre-configured IP address whitelist, including:

When the WebLogic server executes the MuxableSocketT3 class, acquiring startup parameters of the WebLogic server, where the startup parameters include the IP address whitelist;

If the WebLogic server determines that the client's IP matches the IP address whitelist, it determines that the client's IP address is a trusted IP address.

Optionally, the method further includes:

If the WebLogic server determines that the client's IP does not match the IP address whitelist, it refuses to connect with the client, and records the data request as an attack event.

Optionally, the WebLogic server receiving a data request sent by at least one client includes:

The WebLogic server receives the data request sent by the Internet client through the proxy server and the WebLogic server receives the data request sent by the client of the same local area network.

Optionally, before the WebLogic server receives a data request sent by at least one client, the method further includes:

The WebLogic server determines the location of the MuxableSocketT3 class; the WebLogic server adds the steps of a deserialization vulnerability protection method in the MuxableSocketT3 class.

Optionally, the WebLogic server determining the location of the MuxableSocketT3 class includes:

The WebLogic server determines the location of the MuxableSocketT3 class according to whether the MuxableSocketT3 class exists alone.

On the one hand, an embodiment of the present invention provides a device for protecting deserialization vulnerabilities, including:

The T3/T3S protocol data determining unit is configured to receive a data request sent by at least one client, and determine whether the data request includes T3/T3S protocol data;

A judging unit, configured to determine whether the client's IP address is a trusted IP address according to the Internet Protocol IP address of the client and a pre-configured IP address whitelist if it is determined that the data request includes T3/T3S protocol data ；

The T3/T3S protocol data processing unit is configured to process the T3/T3S protocol data if it is determined that the Internet Protocol IP address of the client is a trusted IP address, so that the request is processed by a normal process.

Optionally, the judgment unit is specifically configured to:

When the MuxableSocketT3 class is executed, the startup parameters of the WebLogic server are acquired, and the startup parameters include the IP address whitelist;

If it is determined that the IP of the client matches the white list of IP addresses, it is determined that the IP address of the client is a trusted IP address.

Optionally, the T3/T3S protocol data processing unit is further used for:

If it is determined that the IP of the client does not match the white list of IP addresses, the connection with the client is rejected, and the data request is recorded as an attack event.

Optionally, the T3/T3S protocol data determining unit is specifically configured to:

The proxy server receives data requests sent by Internet clients and data requests sent by clients on the same local area network.

Optionally, the device further includes a configuration unit configured to: determine

In the position of the MuxableSocketT3 class, the steps for the protection method of deserialization vulnerability are added to the MuxableSocketT3 class.

Optionally, the configuration unit is specifically used for:

The location of the MuxableSocketT3 class is determined according to whether the MuxableSocketT3 class exists alone.

On the one hand, an embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor implements protection against deserialization vulnerabilities when the program is executed. Method steps.

On the one hand, an embodiment of the present invention provides a computer-readable storage medium that stores a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the deserialization vulnerability. Steps of protection methods.

On the one hand, an embodiment of the present invention provides a computer program product, including a calculation program stored on a computer-readable storage medium, the computer program including program instructions, when the program instructions are executed by a computer, the computer The device executes the steps of the deserialization vulnerability protection method.

After the WebLogic server receives the data request sent by the client, if it is determined that the data request includes T3/T3S protocol data, it may be attacked by Java deserialization vulnerability, so continue to determine whether the client's IP address is based on the IP address whitelist The trusted IP address, if it is, will process the T3/T3S protocol data, that is, by setting a whitelist in the WebLogic server, it can effectively block the T3/T3S protocol data sent by untrusted clients, and prevent it as much as possible The attack of deserialization vulnerability improves the security of WebLogic server. And setting a whitelist in the WebLogic server can effectively prevent the attack of deserialization vulnerabilities, and it can also protect against deserialization vulnerabilities caused by newly emerging classes. When protecting against deserialization vulnerabilities, the basic classes of Java or the classes of other public components are not modified, nor are classes deleted, which will not affect the normal functions of WebLogic and avoid problems such as unstable application operation. Since the whitelists are all clients that have a high degree of trust with the WebLogic server (such as servers used by internal operation and maintenance personnel), they will not launch attacks on the WebLogic service, so the problems in the prior art are solved.

Description of the drawings

FIG. 1 is a schematic diagram of a scenario where a proxy server is deployed on another server independent of the WebLogic server according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a scenario where a proxy application and WebLogic are deployed on the same server according to an embodiment of the present invention;

3 is a schematic flowchart of a method for protecting deserialization vulnerabilities according to an embodiment of the present invention;

4 is a schematic diagram of a WebLogic processing flow provided by an embodiment of the present invention;

5 is a schematic flowchart of a MuxableSocketT3 positioning method provided by an embodiment of the present invention;

6 is a schematic flowchart of a MuxableSocketT3 positioning method provided by an embodiment of the present invention;

FIG. 7 is a schematic flowchart of a method for protecting deserialization vulnerabilities according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a protection device for deserialization vulnerabilities provided by an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a computer device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions, and beneficial effects of the present application clearer, the following further describes the present application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the application, but not to limit the application.

To facilitate understanding, the terms involved in the embodiments of the present application are explained below.

WebLogic: WebLogic is an application server produced by Oracle Corporation of the United States. To be precise, it is a middleware based on JAVAEE (Java Platform Enterprise Edition) architecture. WebLogic is used to develop, integrate, deploy and manage large-scale distributed Web applications and network applications. And the Java application server for database applications. The dynamic functions of Java and the security of Java Enterprise standards are introduced into the development, integration, deployment and management of large-scale network applications.

Serialization and deserialization, the process of serialization is to turn an object into data that can be transmitted, and the process of deserialization is the process of turning serialized data back into an object.

Deserialization vulnerability. If a Java application deserializes user input, that is, untrusted data, an attacker can construct malicious input to make deserialization produce unexpected objects, which are in the process of being generated. It may bring arbitrary code execution. When exploiting WebLogic Java deserialization vulnerabilities, it is necessary to send T3/T3S protocol packets to the port where WebLogic provides services. T3 is an optimized protocol used to transfer data between WebLogic Server and other Java programs (including clients and other WebLogic Servers). WebLogic Server will track each Java Virtual Machine (JVM) connected to it, and create a single T3 connection to carry all the traffic of each JVM. T3S is the WebLogic T3 protocol on SSL (Secure Sockets Layer).

In the specific practice, the inventor of the present invention found that the default service port in WebLogic is 7001, which provides a connection to HTTP (Hypertext Transfer Protocol)/HTTPS (Hypertext Transfer Protocol Secure, Hypertext Security). Transmission protocol), SNMP (Simple Network Management Protocol, Simple Network Management Protocol), T3/T3S and other protocol services. Because different protocols of WebLogic use one port, it is impossible to prevent Java deserialization vulnerabilities by restricting port access through firewalls. With the development of financial technology, financial institutions in the financial industry (such as banking institutions, insurance institutions and securities institutions, etc.) have higher and higher technical requirements. Traditional deserialization methods seriously fail to meet the requirements of banking institutions and other financial institutions. Therefore, a concept was first proposed to add a proxy server between the customer and the WebLogic server of a financial institution such as a bank, so that the request data of Java deserialization vulnerability is filtered by the proxy server and will not be sent to the WebLogic server.

The protection idea is to make the data sent by the user only meet the HTTP/HTTPS protocol can be forwarded to the WebLogic server through the proxy server, because the Java deserialized data protocol is T3/T3S, does not meet the HTTP/HTTPS protocol, so It will be filtered by the proxy server, and the WebLogic server cannot receive Java deserialized data, so it can protect against vulnerabilities.

However, the applicant of this application discovered during the experiment that the location of the proxy server will lead to different results. There are several different deployment schemes:

Deployment plan 1. The proxy server is deployed on other servers independent of the WebLogic server. As shown in Figure 1, when the proxy server is deployed on other servers independent of the WebLogic server, the listening IP address needs to be set to "0.0." in the WebLogic management console. 0.0", so that the proxy server can access the services provided by WebLogic.

The port provided by WebLogic can remain unchanged and continue to monitor the original port. For example, WebLogic's original listening port is 7001, so continue to use this port.

In this deployment method, normal users can normally access the services provided by WebLogic through the proxy server, and the attacker cannot send T3/T3S protocol Java deserialization exploit data packets to WebLogic via the Internet. Other servers (including proxy servers) can still access the T3/T3S protocol services provided by WebLogic normally.

However, the disadvantage of this deployment is that, as shown in Figure 1, if an attacker controls other servers (including proxy servers) in the LAN through other vulnerabilities or security issues, the controlled machine can send Java anti-sequence from the LAN to the WebLogic server. Exploiting the vulnerability exploit data package to exploit the vulnerability. In other words, it can only protect against deserialization vulnerability attacks initiated via the Internet, and cannot protect against vulnerability attacks initiated by other servers in the LAN.

Deployment plan 2. Deploy the proxy application and WebLogic on the same server, as shown in Figure 2. The proxy application can be deployed on the same server as WebLogic, and the listening IP address of WebLogic can be set to "127.0.0.1"; or the listening IP address can be set to "0.0.0.0", and the IP that is allowed to access the WebLogic service port is checked through the firewall limit. Through the above settings, it is possible to restrict that only this machine can access the services provided by WebLogic, and other machines cannot. For example, using the iptables command of the Linux operating system and setting only the "127.0.0.1" IP address/loopback network interface to access the WebLogic service port, the above restrictions can be completed.

The port provided by WebLogic needs to be modified to another port, and the proxy server monitors the port originally provided by WebLogic. For example, the original monitoring port of WebLogic is 7001, but port 8001 is used instead, and the proxy application monitors port 7001.

In this deployment method, normal users can normally access the services provided by WebLogic through the proxy server. Attackers cannot send T3/T3S protocol Java deserialization exploit packets to WebLogic via the Internet, nor can they pass through the controlled LAN. Other servers send.

However, the disadvantage of this deployment method is that it needs to modify the service port provided by WebLogic and adjust the network strategy, which may affect normal business functions; the need to add proxy applications to the WebLogic server will increase the server's performance overhead and may affect normal business functions; The service port of WebLogic can only be accessed on the local machine. As the T3/T3S service provided by WebLogic cannot be accessed on other servers in the local area network, WebLogic can only be managed on the local machine of the WebLogic server, and remote commands cannot be performed on the WebLogic service. Management reduces the availability of WebLogic and has an impact on operation and maintenance; after adjusting according to the above deployment plan, in order to verify whether the normal business functions are affected, a larger scope of testing is required, which will bring a larger test workload.

Based on the shortcomings of the above deployment, the applicant of this application further improved the method of protecting deserialization vulnerabilities, as shown in Figure 3, including the following steps:

Step S301: The WebLogic server receives a data request sent by at least one client, and determines whether the data request includes T3/T3S protocol data.

Specifically, in the embodiment of the present invention, the WebLogic server receives a data request sent by at least one client, and a WebLogic server connects with at least one client, and receives the data request sent by the client.

In an optional embodiment, the data request received by the WebLogic server includes T3/T3S protocol data, that is, the data request may cause an attack of deserialization vulnerability. Specifically, when it is necessary to execute WebLogic's stop or start script on the WebLogic server, the client will send T3/T3S protocol data to the WebLogic server; when it is necessary to use WLST (WebLogic Scripting Tool, WebLogic scripting tool) to command WebLogic During configuration and management, the client will send T3/T3S protocol data to the WebLogic server; when it is necessary to write a program that uses the T3/T3S protocol to communicate to monitor and manage WebLogic, the client will send T3/T3S to the WebLogic server Protocol data.

Step S302: If the WebLogic server determines that the data request includes T3/T3S protocol data, it determines whether the client's IP address is trusted according to the client's Internet Protocol IP address and a pre-configured IP address whitelist IP address.

Specifically, it is determined that the data request sent by the client received by the WebLogic server includes T3/T3S protocol data, which means that the data request may be deserialized exploit data, which may cause the WebLogic server to be attacked, so in order to improve the WebLogic server’s performance Security, through the pre-configured IP address whitelist and the IP address of the client sending the T3/T3S protocol data, it is determined whether the T3/T3S protocol data needs to be processed normally or the request is rejected.

Optionally, determine whether to process the T3/T3S protocol data by determining whether the client's IP address is a trusted IP address, that is, in the embodiment of the present invention, the client in the IP address whitelist can be considered as Clients with higher security have extremely high credibility. If these clients are also hijacked, it can be considered that all servers have been controlled by the attacker.

Therefore, a client that meets the IP address whitelist is a trusted client, and the T3/T3S protocol data sent by the client is trusted, and a client that does not meet the IP address whitelist is an untrusted client. The T3/T3S protocol data sent by the client is also untrustworthy.

In the embodiment of the present invention, the IP address whitelist in the WebLogic server is preset. The IP address whitelist is determined according to the security level of each client in the entire network. Optionally, it is added to the startup parameters of the Java program The configuration file name. The configuration file name is the IP address whitelist. When the IP address whitelist is changed, it can be realized by modifying the configuration file or adding the configuration file or replacing the configuration file.

Optionally, in the embodiment of the present invention, if the WebLogic server wants to realize the judgment of the IP address whitelist, it also needs to determine the class of processing T3/T3S in the WebLogic server.

Specifically, the abnormal information recorded in the WebLogic log when the historical WebLogic Java deserialization vulnerability is triggered can be used to determine the T3/T3S class in the WebLogic server.

The exception information contains the stack information when the vulnerability is triggered, and the processing flow of WebLogic can be understood according to the stack information. After analysis, it is found that when the vulnerability is triggered, WebLogic will process the T3/T3S protocol data according to fixed steps. After the thread-related classes and socket-related classes are processed, the Java deserialization process is finally performed. The specific process is as follows As shown in Figure 4, after analysis, it can be confirmed that the class that WebLogic handles the T3 protocol is "WebLogic.rjvm.t3.MuxableSocketT3"; the class that handles the T3S protocol is "WebLogic.rjvm.t3.MuxableSocketT3S", which inherits from the MuxableSocketT3 class and MuxableSocketT3S There is no modification to the protocol processing in the class, so only the MuxableSocketT3 class needs to be processed.

That is to say, modifying the MuxableSocketT3 class of the WebLogic server can increase the judging process of judging whether the IP address is in the whitelist.

Specifically, before optimizing the MuxableSocketT3 class, you need to locate the jar package path where MuxableSocketT3 is located. You can locate MuxableSocketT3 through the following methods.

The first method, when the MuxableSocketT3 class exists alone, install any J2EE application in WebLogic, create a JSP file in the application directory where the JSP (Java Server Pages, JAVA server page) file can be parsed, and save the following content with The jar package location where the MuxableSocketT3 class is output, as shown in Figure 5, including:

Step S501: Obtain a class object of WebLogic.rjvm.t3.MuxableSocketT3;

Step S502, call the getResource("").getPath() method of the above object;

Step S503: Obtain the jar package path where the MuxableSocketT3 class returned by the above method is located;

Step S504, print the path of the jar package where the MuxableSocketT3 class is located.

The second method, when the MuxableSocketT3 class exists in the jar package, install any J2EE application in WebLogic, create a JSP file in the application directory where the JSP file can be parsed, and save the following content to output the jar package where the MuxableSocketT3 class is located The location, as shown in Figure 6, includes:

Step S601: Obtain a class object of WebLogic.rjvm.t3.MuxableSocketT3;

Step S602, call getProtectionDomain().getCodeSource() of the above object.

getFile() method;

Step S603, obtain the jar package path where the MuxableSocketT3 class returned by the above method is located;

Step S604, print the path of the jar package where the MuxableSocketT3 class is located.

Use a browser to access the JSP file created above, and it will output the full path of the jar package where the MuxableSocketT3 class is located.

After locating the jar package where the MuxableSocketT3 class is located, start to improve the T3/T3S protocol processing flow of the MuxableSocketT3 class so that the WebLogic server can determine whether the client's IP address is an IP address in the whitelist after receiving the T3/T3S protocol.

After completing the improvement to the MuxableSocketT3 class, you need to update the MuxableSocketT3 class related files in the jar package to the improved class, which will take effect after restarting WebLogic.

It can be known from the foregoing that if the WebLogic server determines that the client's IP matches the IP address whitelist, it determines whether the client's IP address is a trusted IP address.

Step S303: If the WebLogic server determines that the Internet Protocol IP address of the client is a trusted IP address, it processes the T3/T3S protocol data so that the request is processed by the normal process.

Specifically, when the client is determined to be a trusted client, the T3/T3S protocol data is executed, for example, the WebLogic server locally executes WebLogic's stop script or startup script; or WebLogic executes command configuration and management operations; Or WebLogic performs functional operations such as monitoring and management.

In an optional embodiment, when the WebLogic server determines that the client's IP does not match the IP address whitelist, it refuses to connect with the client, and records the data request as an attack event, and the attack Event recording allows analysis of attack events.

In the embodiment of the present invention, in order to avoid other potential security problems after the WebLogic server port is directly exposed on the Internet, a proxy server can also be deployed between the user and the WebLogic server. The proxy server can be deployed on a separate server without increasing The performance overhead of the WebLogic server will not affect normal business; when performing verification, the scope of the test is small and the test workload is also small. It will not affect normal functions, and there is no hidden danger of Java deserialization vulnerabilities.

In other words, the WebLogic server receives data requests sent by Internet clients through the proxy server and the WebLogic server receives data requests sent by clients on the same local area network. It will not increase the performance overhead of the WebLogic server and will not affect the normal business; when verifying, the scope of the test is small and the test workload is also small. It will not affect normal functions, and there is no hidden danger of Java deserialization vulnerabilities.

Through the content of the above-mentioned embodiments of the present invention, without affecting normal users to use various business functions, attackers cannot use WebLogic Java deserialization vulnerabilities on the Internet, nor can they use WebLogic Java deserialization vulnerabilities after controlling other servers in the LAN. Compared with the prior art, the T3/T3S service provided by WebLogic can only be accessed through trusted servers. For example, the WebLogic server's native machine or the server with perfect protection measures used by operation and maintenance personnel can react to Java caused by unknown classes. Serialization vulnerabilities are protected to the greatest extent possible to protect WebLogic from Java deserialization vulnerabilities; and other trusted servers are allowed to access T3/T3S services provided by WebLogic, and WebLogic services can be remotely commanded from other trusted servers Management, does not affect the availability of WebLogic, and does not affect operation and maintenance; it can perceive and obtain threat intelligence information when an attacker tries to exploit WebLogic Java deserialization vulnerabilities; it does not need to modify the service port provided by WebLogic, or adjust the network The strategy does not affect normal business functions; there is no need to add a proxy application to the WebLogic server, does not increase the performance overhead of the WebLogic server, and does not affect the normal business; according to the method in the embodiment of the present invention, a whitelist judgment is added to WebLogic Later, in order to verify whether it affects normal business functions, the scope of testing is small and the testing workload is also small.

In order to better explain the embodiments of this application, the following describes a deserialization vulnerability protection method provided by the embodiments of this application in conjunction with specific implementation scenarios. This method is applied to the WebLogic server where the bank and other financial institutions are located. The configuration file name is added to the startup parameters of the Java program, that is, the IP address whitelist is added, which is used to dynamically configure the trusted IP that allows WebLogic to receive the T3/T3S protocol, that is, after modifying the trusted IP, there is no need to restart the WebLogic server To take effect. In the dispatch method of MuxableSocketT3 class for processing T3/T3S protocol data, every time a T3/T3S protocol request is received, the trusted IP is read from the specified configuration file to determine whether the current request IP is a trusted IP. If it is a trusted IP, it will continue to process the T3/T3S protocol; if it is not a trusted IP, the connection will be rejected and the attack event details will be recorded in a specific log file. The optimized dispatch method of the MuxableSocketT3 class is shown in Figure 7 and applied to the WebLogic server. The specific steps are:

Step S701, receiving T3/T3S protocol data;

Step S702, obtaining a whitelist of IP addresses configured in the startup parameters of the Java program;

Step S703: It is judged whether the IP address of the current client sending T3/T3S protocol data matches the IP address in the IP address whitelist, if yes, go to step S704; otherwise, go to step S705;

Step S704, execute T3/T3S protocol data;

Step S705: Reject the connection with the client, and record the data request as an attack event.

Based on the same technical concept, an embodiment of the present application provides a device for protecting deserialization vulnerabilities. As shown in FIG. 8, the device 800 includes:

The T3/T3S protocol data determining unit 801 is configured to receive a data request sent by at least one client, and determine whether the data request includes T3/T3S protocol data;

The judging unit 802 is configured to, if it is determined that the data request includes T3/T3S protocol data, determine whether the IP address of the client is a trusted IP according to the Internet Protocol IP address of the client and a pre-configured IP address whitelist address;

The T3/T3S protocol data processing unit 803 is configured to process the T3/T3S protocol data if it is determined that the Internet Protocol IP address of the client is a trusted IP address, so that the request is processed by the normal process.

Further, the determining unit 802 is specifically configured to:

Further, the T3/T3S protocol data processing unit 803 is also used for:

Further, the T3/T3S protocol data determining unit 801 is specifically configured to:

Further, the device further includes a configuration unit 804:

It is used to determine the position of the MuxableSocketT3 class, and add the steps of the deserialization vulnerability protection method in the MuxableSocketT3 class.

Further, the configuration unit 804 is specifically configured to:

Based on the same technical concept, an embodiment of the present application provides a computer device. As shown in FIG. 9, it includes at least one processor 901 and a memory 902 connected to the at least one processor. The embodiment of the present application does not limit the processor. The specific connection medium between the 901 and the memory 902 is the connection between the processor 901 and the memory 902 through a bus in FIG. 9 as an example. The bus can be divided into address bus, data bus, control bus, etc.

In the embodiment of the present application, the memory 902 stores instructions that can be executed by at least one processor 901. By executing the instructions stored in the memory 902, the at least one processor 901 can execute the aforementioned deserialization vulnerability protection method. step.

Among them, the processor 901 is the control center of the computer equipment, which can use various interfaces and lines to connect to various parts of the terminal equipment, and obtain customers by running or executing instructions stored in the memory 902 and calling data stored in the memory 902. End address. Optionally, the processor 901 may include one or more processing units, and the processor 901 may integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, and application programs. The adjustment processor mainly deals with wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 901. In some embodiments, the processor 901 and the memory 902 may be implemented on the same chip, and in some embodiments, they may also be implemented on separate chips.

The processor 901 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application may be directly embodied as executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.

The memory 902, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The memory 902 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), magnetic memory, disk , CD, etc. The memory 902 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory 902 in the embodiment of the present application may also be a circuit or any other device capable of realizing a storage function for storing program instructions and/or data.

Based on the same technical concept, the embodiments of the present application provide a computer-readable storage medium that stores a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the reverse sequence. Steps of the method of protection against vulnerabilities.

Based on the same technical concept, the embodiments of the present application provide a computer program product, including a calculation program stored on a computer-readable storage medium, the computer program including program instructions, when the program instructions are executed by a computer, The computer device executes the steps of the deserialization vulnerability protection method.

A person of ordinary skill in the art can understand that all or part of the steps in the above method embodiments can be implemented by a program instructing relevant hardware. The foregoing program can be stored in a computer readable storage medium. When the program is executed, it is executed. Including the steps of the foregoing method embodiment; and the foregoing storage medium includes: removable storage devices, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks, etc. A medium that can store program codes.

Alternatively, if the above-mentioned integrated unit of this application is implemented in the form of a software function module and sold or used as an independent product, it may also be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product in essence or a part that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for A computer device (which may be a personal computer, a server, or a network device, etc.) executes all or part of the methods described in the various embodiments of the present application. The aforementioned storage media include: removable storage devices, ROM, RAM, magnetic disks or optical disks and other media that can store program codes.

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

A method for protecting deserialization vulnerabilities, which is characterized in that it is applied to a WebLogic server, and the method includes:

The WebLogic server receives a data request sent by at least one client, and determines whether the data request includes T3/T3S protocol data;

If the WebLogic server determines that the data request includes T3/T3S protocol data, it determines whether the client's IP address is a trusted IP address according to the Internet Protocol IP address of the client and a pre-configured IP address whitelist;

If the WebLogic server determines that the Internet Protocol IP address of the client is a trusted IP address, it processes the T3/T3S protocol data so that the request is processed by the normal process.
The method according to claim 1, wherein the WebLogic server determines whether the client's IP address is a trusted IP address according to the client's Internet Protocol IP address and a pre-configured IP address whitelist, comprising:

When the WebLogic server executes the MuxableSocketT3 class, acquiring startup parameters of the WebLogic server, where the startup parameters include the IP address whitelist;

If the WebLogic server determines that the client's IP matches the IP address whitelist, it determines that the client's IP address is a trusted IP address.
The method of claim 2, wherein the method further comprises:

If the WebLogic server determines that the client's IP does not match the IP address whitelist, it refuses to connect with the client, and records the data request as an attack event.
The method according to claim 1, wherein the WebLogic server receiving a data request sent by at least one client comprises:

The WebLogic server receives the data request sent by the Internet client through the proxy server and the WebLogic server receives the data request sent by the client of the same local area network.
The method according to claim 2, wherein before the WebLogic server receives a data request sent by at least one client, the method further comprises:

The WebLogic server determines the location of the MuxableSocketT3 class; the WebLogic server adds the steps of a deserialization vulnerability protection method in the MuxableSocketT3 class.
The method of claim 5, wherein the WebLogic server determining the location of the MuxableSocketT3 class comprises:

The WebLogic server determines the location of the MuxableSocketT3 class according to whether the MuxableSocketT3 class exists alone.
A protection device for deserialization loopholes, characterized in that the device includes:

The T3/T3S protocol data determining unit is configured to receive a data request sent by at least one client, and determine whether the data request includes T3/T3S protocol data;

A judging unit, configured to determine whether the client's IP address is a trusted IP address according to the Internet Protocol IP address of the client and a pre-configured IP address whitelist if it is determined that the data request includes T3/T3S protocol data ；

The T3/T3S protocol data processing unit is configured to process the T3/T3S protocol data if it is determined that the Internet Protocol IP address of the client is a trusted IP address, so that the request is processed by a normal process.
The device according to claim 7, wherein the judgment unit is specifically configured to:

When the MuxableSocketT3 class is executed, the startup parameters of the WebLogic server are acquired, and the startup parameters include the IP address whitelist;

If it is determined that the IP of the client matches the white list of IP addresses, it is determined that the IP address of the client is a trusted IP address.
The device according to claim 8, wherein the T3/T3S protocol data processing unit is further configured to:

If it is determined that the IP of the client does not match the white list of IP addresses, the connection with the client is rejected, and the data request is recorded as an attack event.
The device according to claim 7, wherein the T3/T3S protocol data determining unit is specifically configured to:

The proxy server receives data requests sent by Internet clients and data requests sent by clients on the same local area network.
The device according to claim 8, characterized in that the device further comprises a configuration unit, the configuration unit is used to: determine the position of the MuxableSocketT3 class, and add a deserialization vulnerability protection method to the MuxableSocketT3 class .
The device according to claim 11, wherein the configuration unit is specifically configured to:

The location of the MuxableSocketT3 class is determined according to whether the MuxableSocketT3 class exists alone.
A computer device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the processor executes the computer program when the computer program is executed. The steps of the method.
A computer-readable storage medium, characterized in that it stores a computer program that can be executed by a computer device, and when the program runs on the computer device, the computer executes the computer program described in any one of claims 1 to 6 method.
A computer program product, characterized in that the computer program product includes a calculation program stored on a computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer Perform the method of any one of claims 1 to 6.